Derechos · Privacidad

Right of access

The data subject shall have the right to obtain from Navantia confirmation as to whether or not personal data concerning them are being processed and, where that is the case, access to the personal data and to the following information:

The purposes of the processing.
The categories of personal data concerned.
The recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations.
Where possible, the envisaged period for which the personal data will be stored or, if not possible, the criteria used to determine that period.
The existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing.
The right to lodge a complaint with a supervisory authority.
Where the personal data are not collected from the data subject, any available information as to their source.
The existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Likewise, where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards relating to the transfer pursuant to Article 46 of the GDPR.

Navantia shall provide a copy of the personal data undergoing processing and may charge a reasonable fee based on administrative costs for any further copies requested by the data subject. Where the data subject makes the request by electronic means, and unless otherwise requested, the information shall be provided in a commonly used electronic form.

Right to rectification

The data subject shall have the right to obtain from Navantia without undue delay the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed.

Right to erasure (right to be forgotten)

The data subject shall have the right to obtain from Navantia the erasure of personal data concerning them without undue delay and Navantia shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
The data subject withdraws consent on which the processing is based and where there is no other legal ground for the processing.

The data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2).
The personal data have been unlawfully processed.
The personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
The personal data have been collected in relation to the offer of information society services referred to in Article 8(1) of the GDPR.

Where Navantia has made the personal data public and is obliged pursuant to the GDPR to erase the personal data, Navantia, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to those personal data or copies or replications thereof.

The right to erasure shall not apply to the extent that processing is necessary:

For exercising the right of freedom of expression and information.
For compliance with a legal obligation which requires processing by Union or Member State law to which Navantia is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in Navantia.
For reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) of the GDPR and Article 9(3).
For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) of the GDPR in so far as the right is likely to render impossible or seriously impair the achievement of the objectives of that processing.
For the establishment, exercise or defence of legal claims.

Right to restriction of processing

The data subject shall have the right to obtain from Navantia restriction of processing where one of the following applies:

The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.
The processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead.
Navantia no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims.
The data subject has objected to processing pending the verification whether Navantia’s legitimate grounds override those of the data subject.

Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

A data subject who has obtained restriction of processing shall be informed by Navantia before the restriction of processing is lifted.

Right to data portability

The data subject shall have the right to receive the personal data concerning them, which they have provided to Navantia, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from Navantia where the following two conditions are met:

The processing is based on consent or on a contract.
The processing is carried out by automated means.

In exercising the right to data portability, the data subject shall have the right to have the personal data transmitted directly from Navantia to another controller, where technically feasible.

The right to data portability shall be without prejudice to the right to erasure (right to be forgotten). That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in Navantia.

The exercise of this right shall not adversely affect the rights and freedoms of others.

Right to object

The data subject shall have the right to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them which is based on Article 6(1)(e) public interest or (f) legitimate interest of the GDPR, including profiling based on those provisions. Navantia shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

At the latest at the time of the first communication with the data subject, the right shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information.

In the context of the use of information society services and notwithstanding Directive 2002/58/EC, the data subject may exercise their right to object by automated means using technical specifications.

Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), the data subject shall have the right, on grounds relating to their particular situation, to object to processing of personal data concerning them, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

Automated individual decision-making

The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

The data subject may not exercise this right if the processing:

Is necessary for entering into, or performance of, a contract between the data subject and Navantia.
Is authorised by Union or Member State law to which Navantia is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests.
Is based on the data subject’s explicit consent.

In the cases referred to in points (a) and (c) above, Navantia shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of Navantia, to express their point of view and to contest the decision.

The exceptions indicated in the preceding paragraph shall not be based on special categories of personal data unless the data subject has given explicit consent to the processing of such personal data for one or more specified purposes or the processing is necessary for reasons of substantial public interest.

Exercising rights in relation to data of deceased persons

As established in Article 3 of the LOPDGDD regarding deceased persons, the following rights are granted to persons linked to them:

Persons related to the deceased for family reasons or as a matter of fact, as well as their heirs, may contact Navantia in order to request access to the deceased’s personal data and, where appropriate, their rectification or erasure. By way of exception to the above, they may not access the deceased’s data or request their rectification or erasure where the deceased has expressly prohibited this or where this is provided for by law. This prohibition shall not affect the right of heirs to access the deceased’s data of a purely economic nature.
Persons or institutions expressly designated by the deceased for this purpose may also request Navantia, in accordance with the instructions received, to provide access to the deceased’s personal data and, where appropriate, their rectification or erasure.
Where the deceased was a minor, the right of access and, where appropriate, rectification or erasure may be exercised before Navantia by their legal representatives or, within the scope of their competence, by the Public Prosecutor’s Office, which may act ex officio or at the request of any natural or legal person with a legitimate interest. In the event of the death of persons with disabilities, these rights may also be exercised, in addition to those mentioned in the previous paragraph, by those appointed to provide support, where such powers are understood to be included in the support measures provided by the appointee.

Requirements for handling rights

Requests to exercise rights submitted to Navantia shall be dealt with in accordance with the following requirements:

Handling of requests to exercise rights: Navantia shall deal with the exercise of rights under Articles 15 to 22 of the GDPR, except where Navantia is able to demonstrate that it is not in a position to identify the data subject.

Where Navantia has reasonable doubts concerning the identity of the natural person making a request to exercise rights, it may request the provision of additional information necessary to confirm the identity of the data subject.

Time limits: Navantia shall provide information on action taken on a request to exercise rights without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of requests. Navantia shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay.
Means: Where the data subject makes the request to exercise rights by electronic means, the information shall be provided by electronic means where possible, unless the data subject requests otherwise.
Refusal: Where Navantia does not take action on the data subject’s request, it shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and of the possibility of lodging a complaint with the Spanish Data Protection Agency (AEPD) and seeking a judicial remedy.

Dealing with requests to exercise rights shall be free of charge for the data subject. Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, Navantia may:

Charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested.
Means: Where the data subject makes the request to exercise rights by electronic means, the information shall be provided by electronic means where possible, unless the data subject requests otherwise.
Refuse to act on the request.

Navantia shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.

Channels for submitting requests to exercise rights

The following means are available to data subjects to submit requests to exercise their rights:

In person: by submitting your request to exercise your rights at any of Navantia’s document entry registers, FAO: Data Protection Officer.
By email: you can send your queries or requests relating to rights recognised by the applicable regulations to the following email address: [email protected]
By post: by sending a letter by ordinary post to Navantia, S.A. – C/ Velázquez, 132 – 28006 Madrid, stating in the subject line: FAO: Privacy and Data Protection Office.

Rights